NCJ Number
79424
Date Published
1975
Length
18 pages
Annotation
Issues involved in the development of a data security system are discussed, based upon a Swedish study of data system threats.
Abstract
The first section of the presentation discusses the need for and the general nature of data security, with attention to the nature of data integrity and privacy. Implications of the 1973 Swedish Act for data security are considered, followed by a listing of possible causes of data damage, based on certain U.S. studies. In order to construct a basis for the design of suitable data security measures, a Swedish study collected information on about 800 'unintentional' threat forms at 9 installations. These were grouped into 72 threat types, then further categorized according to 19 operational situations called 'conditions.' The conditions were grouped under three headings: handling of materials and equipment, system operation, and environmental factors. From this data, the deficiencies that caused the threats were analyzed. The relationship between conditions, threats, and deficiencies shows that protective measures can be designed that will have a predictable effect on the risk from various unintentional threats. The components of data security are divided into basic security, which involves measures to prevent unintentional modification, destruction, or disclosure of data and to preclude ill-intentioned attempts on the part of normal users to gain unauthorized access to data; and supplementary security, which involves measures to avert intentional threats to which various computer installations may be exposed. Available security measures are listed under the categories of measures in organization and administration, measures in software and hardware, and measures for physical protection, A method for measuring the cost-effectiveness of a proposed security system is described, and charts are presented to show steps in a general action plan for design of data security systems and the planning and implementation of data security systems.